Critical Langflow RCE CVE-2026-33017 Exploited Within 20 Hours — CISA Orders Federal Patch by April 8

If you are running Langflow version 1.8.1 or earlier, you have an unauthenticated remote code execution vulnerability in production. Patch to 1.9.0 now.

CVE-2026-33017 — CVSS 9.3 (Critical) — affects the Langflow AI pipeline platform’s public flow builder endpoint. The vulnerable path is POST /api/v1/build_public_tmp/{flow_id}/flow, which allows arbitrary Python code execution without requiring authentication. An attacker who can reach this endpoint — which is exposed by default in publicly accessible Langflow deployments — can run any code on the server with the privileges of the Langflow process.

The advisory dropped on March 17. Within 20 hours, active exploitation was confirmed in the wild. CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on March 25 and set a federal agency remediation deadline of April 8, 2026. For non-federal organizations, the KEV deadline is a strong signal: treat this as a zero-day with active exploits, because that is exactly what it is.

Langflow is widely deployed in enterprise AI teams building LLM pipelines, RAG systems, and agent workflows. It provides a visual drag-and-drop interface for connecting models, vector databases, and tools — and it runs as a backend service that teams often expose internally or through reverse proxies. The combination of broad deployment, Python execution capability, and an unauthenticated endpoint is severe.

What the vulnerability allows: Full server compromise. An attacker can exfiltrate API keys stored in Langflow’s environment, access connected databases and vector stores, pivot to adjacent internal services, or plant persistent backdoors. Any secrets your Langflow instance can reach — OpenAI API keys, Pinecone credentials, database passwords — should be considered compromised if you were running an exposed instance on ≤1.8.1.

Fix:

pip install langflow==1.9.0
# or if using Docker:
docker pull langflowai/langflow:1.9.0

If you cannot update immediately, disable public-facing access to the flow builder endpoint at your reverse proxy or firewall. The specific route to block is /api/v1/build_public_tmp/. This is a mitigation, not a fix — upgrade as soon as operationally possible.

Check your version:

langflow --version
# or via the API:
curl http://localhost:7860/api/v1/version

Qualys, Snyk, and BleepingComputer have all confirmed active scanning activity targeting this endpoint across internet-exposed Langflow instances. The exploitation window between advisory and weaponization — 20 hours — puts this in the same category as Log4Shell and the Confluence RCEs that burned enterprises in prior years.

If you operate Langflow and have not patched yet, assume compromise and rotate all secrets the instance had access to. Audit your logs for unexpected outbound connections from the Langflow process starting March 17.